Merge pull request #2522 from github/update-v3.26.11-8aba5f2c4

Merge main into releases/v3
2024-10-03 13:00:22 -07:00 · 2024-10-03 13:00:22 -07:00 · 6db8d6351f
commit 6db8d6351f
parent e2b3eafc8d 389647f398
5429 changed files with 2177317 additions and 72053 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -16,6 +16,10 @@ updates:
      # v7 requires ESM
      - dependency-name: "del"
        versions: ["^7.0.0"]
+      # This is broken due to the way configuration files have changed. 
+      # This might be fixed when we move to eslint v9.
+      - dependency-name: "eslint-plugin-import"
+        versions: [">=2.30.0"]
    groups:
      npm:
        patterns:
--- a/.github/workflows/debug-artifacts-upgrade.yml
+++ b/.github/workflows/debug-artifacts-upgrade.yml
@ -0,0 +1,99 @@
+# Checks logs, SARIF, and database bundle debug artifacts exist and are accessible
+# with download-artifact@v4 when CODEQL_ACTION_ARTIFACT_V4_UPGRADE is set to true.
+name: PR Check - Debug artifact upload using artifact@v2
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  CODEQL_ACTION_ARTIFACT_V4_UPGRADE: true
+on:
+  push:
+    branches:
+    - main
+    - releases/v*
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+jobs:
+  upload-artifacts:
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+        - stable-v2.13.5
+        - stable-v2.14.6
+        - stable-v2.15.5
+        - stable-v2.16.6
+        - stable-v2.17.6
+        - default
+        - linked
+        - nightly-latest
+    name: Upload debug artifacts
+    env:
+      CODEQL_ACTION_TEST_MODE: true
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ^1.13.1
+      - uses: ./../action/init
+        id: init
+        with:
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          debug: true
+          debug-artifact-name: my-debug-artifacts
+          debug-database-name: my-db
+          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
+          languages: cpp,csharp,go,java,javascript,python,ruby 
+      - name: Build code
+        shell: bash
+        run: ./build.sh
+      - uses: ./../action/analyze
+        id: analysis
+  download-and-check-artifacts:
+    name: Download and check debug artifacts
+    needs: upload-artifacts
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+      - name: Check expected artifacts exist
+        shell: bash
+        run: |
+          VERSIONS="stable-v2.13.5 stable-v2.14.6 stable-v2.15.5 stable-v2.16.6 stable-v2.17.6 default linked nightly-latest"
+          LANGUAGES="cpp csharp go java javascript python"
+          for version in $VERSIONS; do
+            pushd "./my-debug-artifacts-${version//./}"
+            echo "Artifacts from version $version:"
+            for language in $LANGUAGES; do
+              echo "- Checking $language"
+              if [[ ! -f "$language.sarif" ]] ; then
+                echo "Missing a SARIF file for $language"
+                exit 1
+              fi
+              if [[ ! -f "my-db-$language.zip" ]] ; then
+                echo "Missing a database bundle for $language"
+                exit 1
+              fi
+              if [[ ! -d "$language/log" ]] ; then
+                echo "Missing logs for $language"
+                exit 1
+              fi
+            done
+            popd
+          done
+        env:
+          GO111MODULE: auto
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -4,6 +4,14 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

 Note that the only difference between `v2` and `v3` of the CodeQL Action is the node version they support, with `v3` running on node 20 while we continue to release `v2` to support running on node 16. For example `3.22.11` was the first `v3` release and is functionally identical to `2.22.11`. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

+## 3.26.11 - 03 Oct 2024
+
+- _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts. 
+
+  Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped to `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then.
+  
+  This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES. 
+
 ## 3.26.10 - 30 Sep 2024

 - We are rolling out a feature in September/October 2024 that sets up CodeQL using a bundle compressed with [Zstandard](http://facebook.github.io/zstd/). Our aim is to improve the performance of setting up CodeQL. [#2502](https://github.com/github/codeql-action/pull/2502)
--- a/lib/actions-util.js
+++ b/lib/actions-util.js
@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
    return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getFileType = exports.FileCmdNotFoundError = exports.determineMergeBaseCommitOid = exports.getCommitOid = exports.getOptionalInput = exports.getRequiredInput = void 0;
+exports.CommandInvocationError = exports.getFileType = exports.FileCmdNotFoundError = exports.determineMergeBaseCommitOid = exports.getCommitOid = exports.getOptionalInput = exports.getRequiredInput = void 0;
 exports.getTemporaryDirectory = getTemporaryDirectory;
 exports.getRef = getRef;
 exports.getActionVersion = getActionVersion;
@ -37,6 +37,9 @@ exports.getUploadValue = getUploadValue;
 exports.getWorkflowRunID = getWorkflowRunID;
 exports.getWorkflowRunAttempt = getWorkflowRunAttempt;
 exports.isSelfHostedRunner = isSelfHostedRunner;
+exports.prettyPrintInvocation = prettyPrintInvocation;
+exports.ensureEndsInPeriod = ensureEndsInPeriod;
+exports.runTool = runTool;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
@ -429,4 +432,77 @@ exports.getFileType = getFileType;
 function isSelfHostedRunner() {
    return process.env.RUNNER_ENVIRONMENT === "self-hosted";
 }
+function prettyPrintInvocation(cmd, args) {
+    return [cmd, ...args].map((x) => (x.includes(" ") ? `'${x}'` : x)).join(" ");
+}
+/**
+ * An error from a tool invocation, with associated exit code, stderr, etc.
+ */
+class CommandInvocationError extends Error {
+    constructor(cmd, args, exitCode, stderr, stdout) {
+        const prettyCommand = prettyPrintInvocation(cmd, args);
+        const lastLine = ensureEndsInPeriod(stderr.trim().split("\n").pop()?.trim() || "n/a");
+        super(`Failed to run "${prettyCommand}". ` +
+            `Exit code was ${exitCode} and last log line was: ${lastLine} See the logs for more details.`);
+        this.cmd = cmd;
+        this.args = args;
+        this.exitCode = exitCode;
+        this.stderr = stderr;
+        this.stdout = stdout;
+    }
+}
+exports.CommandInvocationError = CommandInvocationError;
+function ensureEndsInPeriod(text) {
+    return text[text.length - 1] === "." ? text : `${text}.`;
+}
+/**
+ * A constant defining the maximum number of characters we will keep from
+ * the programs stderr for logging.
+ *
+ * This serves two purposes:
+ * 1. It avoids an OOM if a program fails in a way that results it
+ *    printing many log lines.
+ * 2. It avoids us hitting the limit of how much data we can send in our
+ *    status reports on GitHub.com.
+ */
+const MAX_STDERR_BUFFER_SIZE = 20000;
+/**
+ * Runs a CLI tool.
+ *
+ * @returns Standard output produced by the tool.
+ * @throws A `CommandInvocationError` if the tool exits with a non-zero status code.
+ */
+async function runTool(cmd, args = [], opts = {}) {
+    let stdout = "";
+    let stderr = "";
+    process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
+    const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+        ignoreReturnCode: true,
+        listeners: {
+            stdout: (data) => {
+                stdout += data.toString("utf8");
+                if (!opts.noStreamStdout) {
+                    process.stdout.write(data);
+                }
+            },
+            stderr: (data) => {
+                let readStartIndex = 0;
+                // If the error is too large, then we only take the last MAX_STDERR_BUFFER_SIZE characters
+                if (data.length - MAX_STDERR_BUFFER_SIZE > 0) {
+                    // Eg: if we have MAX_STDERR_BUFFER_SIZE the start index should be 2.
+                    readStartIndex = data.length - MAX_STDERR_BUFFER_SIZE + 1;
+                }
+                stderr += data.toString("utf8", readStartIndex);
+                // Mimic the standard behavior of the toolrunner by writing stderr to stdout
+                process.stdout.write(data);
+            },
+        },
+        silent: true,
+        ...(opts.stdin ? { input: Buffer.from(opts.stdin || "") } : {}),
+    }).exec();
+    if (exitCode !== 0) {
+        throw new CommandInvocationError(cmd, args, exitCode, stderr, stdout);
+    }
+    return stdout;
+}
 //# sourceMappingURL=actions-util.js.map
--- a/lib/actions-util.js.map
+++ b/lib/actions-util.js.map
--- a/lib/analyze-action-post.js
+++ b/lib/analyze-action-post.js
@ -29,17 +29,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 * other `post:` hooks.
 */
 const core = __importStar(require("@actions/core"));
+const actions_util_1 = require("./actions-util");
+const api_client_1 = require("./api-client");
+const config_utils_1 = require("./config-utils");
 const debugArtifacts = __importStar(require("./debug-artifacts"));
 const environment_1 = require("./environment");
+const feature_flags_1 = require("./feature-flags");
 const logging_1 = require("./logging");
+const repository_1 = require("./repository");
 const util_1 = require("./util");
 async function runWrapper() {
    try {
        const logger = (0, logging_1.getActionsLogger)();
+        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
+        const repositoryNwo = (0, repository_1.parseRepositoryNwo)((0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY"));
+        const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), logger);
        // Upload SARIF artifacts if we determine that this is a first-party analysis run.
        // For third-party runs, this artifact will be uploaded in the `upload-sarif-post` step.
        if (process.env[environment_1.EnvVar.INIT_ACTION_HAS_RUN] === "true") {
-            await (0, logging_1.withGroup)("Uploading combined SARIF debug artifact", () => debugArtifacts.uploadCombinedSarifArtifacts(logger));
+            const config = await (0, config_utils_1.getConfig)((0, actions_util_1.getTemporaryDirectory)(), logger);
+            if (config !== undefined) {
+                await (0, logging_1.withGroup)("Uploading combined SARIF debug artifact", () => debugArtifacts.uploadCombinedSarifArtifacts(logger, config.gitHubVersion.type, features));
+            }
        }
    }
    catch (error) {
--- a/lib/analyze-action-post.js.map
+++ b/lib/analyze-action-post.js.map
@ -1 +1 @@
-{"version":3,"file":"analyze-action-post.js","sourceRoot":"","sources":["../src/analyze-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,oDAAsC;AAEtC,kEAAoD;AACpD,+CAAuC;AACvC,uCAAwD;AACxD,iCAAyC;AAEzC,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;QAElC,kFAAkF;QAClF,wFAAwF;QACxF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,mBAAmB,CAAC,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,IAAA,mBAAS,EAAC,yCAAyC,EAAE,GAAG,EAAE,CAC9D,cAAc,CAAC,4BAA4B,CAAC,MAAM,CAAC,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,oCAAoC,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"analyze-action-post.js","sourceRoot":"","sources":["../src/analyze-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,oDAAsC;AAEtC,iDAAuD;AACvD,6CAAgD;AAChD,iDAA2C;AAC3C,kEAAoD;AACpD,+CAAuC;AACvC,mDAA2C;AAC3C,uCAAwD;AACxD,6CAAkD;AAClD,iCAIgB;AAEhB,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAA,+BAAkB,EACtC,IAAA,0BAAmB,EAAC,mBAAmB,CAAC,CACzC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,aAAa,EACb,IAAA,oCAAqB,GAAE,EACvB,MAAM,CACP,CAAC;QAEF,kFAAkF;QAClF,wFAAwF;QACxF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,mBAAmB,CAAC,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;YAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAA,mBAAS,EAAC,yCAAyC,EAAE,GAAG,EAAE,CAC9D,cAAc,CAAC,4BAA4B,CACzC,MAAM,EACN,MAAM,CAAC,aAAa,CAAC,IAAI,EACzB,QAAQ,CACT,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,oCAAoC,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
--- a/lib/cli-errors.js
+++ b/lib/cli-errors.js
@ -1,26 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cliErrorsConfig = exports.CliConfigErrorCategory = exports.CommandInvocationError = void 0;
+exports.cliErrorsConfig = exports.CliConfigErrorCategory = exports.CliError = void 0;
 exports.getCliConfigCategoryIfExists = getCliConfigCategoryIfExists;
 exports.wrapCliConfigurationError = wrapCliConfigurationError;
+const actions_util_1 = require("./actions-util");
 const doc_url_1 = require("./doc-url");
 const util_1 = require("./util");
 /**
- * A class of Error that we can classify as an error stemming from a CLI
- * invocation, with associated exit code, stderr,etc.
+ * An error from a CodeQL CLI invocation, with associated exit code, stderr, etc.
 */
-class CommandInvocationError extends Error {
-    constructor(cmd, args, exitCode, stderr, stdout) {
-        const prettyCommand = [cmd, ...args]
-            .map((x) => (x.includes(" ") ? `'${x}'` : x))
-            .join(" ");
+class CliError extends Error {
+    constructor({ cmd, args, exitCode, stderr }) {
+        const prettyCommand = (0, actions_util_1.prettyPrintInvocation)(cmd, args);
        const fatalErrors = extractFatalErrors(stderr);
        const autobuildErrors = extractAutobuildErrors(stderr);
        let message;
        if (fatalErrors) {
            message =
                `Encountered a fatal error while running "${prettyCommand}". ` +
-                    `Exit code was ${exitCode} and error was: ${ensureEndsInPeriod(fatalErrors.trim())} See the logs for more details.`;
+                    `Exit code was ${exitCode} and error was: ${(0, actions_util_1.ensureEndsInPeriod)(fatalErrors.trim())} See the logs for more details.`;
        }
        else if (autobuildErrors) {
            message =
@ -29,7 +27,7 @@ class CommandInvocationError extends Error {
                    `Encountered the following error: ${autobuildErrors}`;
        }
        else {
-            const lastLine = ensureEndsInPeriod(stderr.trim().split("\n").pop()?.trim() || "n/a");
+            const lastLine = (0, actions_util_1.ensureEndsInPeriod)(stderr.trim().split("\n").pop()?.trim() || "n/a");
            message =
                `Encountered a fatal error while running "${prettyCommand}". ` +
                    `Exit code was ${exitCode} and last log line was: ${lastLine} See the logs for more details.`;
@ -37,10 +35,9 @@ class CommandInvocationError extends Error {
        super(message);
        this.exitCode = exitCode;
        this.stderr = stderr;
-        this.stdout = stdout;
    }
 }
-exports.CommandInvocationError = CommandInvocationError;
+exports.CliError = CliError;
 /**
 * Provide a better error message from the stderr of a CLI invocation that failed with a fatal
 * error.
@ -89,10 +86,10 @@ function extractFatalErrors(error) {
        }
        const isOneLiner = !fatalErrors.some((e) => e.includes("\n"));
        if (isOneLiner) {
-            fatalErrors = fatalErrors.map(ensureEndsInPeriod);
+            fatalErrors = fatalErrors.map(actions_util_1.ensureEndsInPeriod);
        }
        return [
-            ensureEndsInPeriod(lastError),
+            (0, actions_util_1.ensureEndsInPeriod)(lastError),
            "Context:",
            ...fatalErrors.reverse(),
        ].join(isOneLiner ? " " : "\n");
@ -109,9 +106,6 @@ function extractAutobuildErrors(error) {
    }
    return errorLines.join("\n") || undefined;
 }
-function ensureEndsInPeriod(text) {
-    return text[text.length - 1] === "." ? text : `${text}.`;
-}
 /** Error messages from the CLI that we consider configuration errors and handle specially. */
 var CliConfigErrorCategory;
 (function (CliConfigErrorCategory) {
@ -267,9 +261,6 @@ function getCliConfigCategoryIfExists(cliError) {
 * simply returns the original error.
 */
 function wrapCliConfigurationError(cliError) {
-    if (!(cliError instanceof CommandInvocationError)) {
-        return cliError;
-    }
    const cliConfigErrorCategory = getCliConfigCategoryIfExists(cliError);
    if (cliConfigErrorCategory === undefined) {
        return cliError;
--- a/lib/cli-errors.js.map
+++ b/lib/cli-errors.js.map
--- a/lib/codeql.js
+++ b/lib/codeql.js
@ -241,7 +241,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
        async getVersion() {
            let result = util.getCachedCodeQlVersion();
            if (result === undefined) {
-                const output = await runTool(cmd, ["version", "--format=json"]);
+                const output = await runCli(cmd, ["version", "--format=json"]);
                try {
                    result = JSON.parse(output);
                }
@ -253,7 +253,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            return result;
        },
        async printVersion() {
-            await runTool(cmd, ["version", "--format=json"]);
+            await runCli(cmd, ["version", "--format=json"]);
        },
        async supportsFeature(feature) {
            return (0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), feature);
@ -290,7 +290,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            const overwriteFlag = (0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), tools_features_1.ToolsFeature.ForceOverwrite)
                ? "--force-overwrite"
                : "--overwrite";
-            await runTool(cmd, [
+            await runCli(cmd, [
                "database",
                "init",
                overwriteFlag,
@ -325,10 +325,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            // When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
            // the Actions runtime introduces its own workaround for SIP
            // (https://github.com/actions/runner/pull/416).
-            await runTool(autobuildCmd);
+            await runCli(autobuildCmd);
        },
        async extractScannedLanguage(config, language) {
-            await runTool(cmd, [
+            await runCli(cmd, [
                "database",
                "trace-command",
                "--index-traceless-dbs",
@ -343,7 +343,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                applyAutobuildAzurePipelinesTimeoutFix();
            }
            try {
-                await runTool(cmd, [
+                await runCli(cmd, [
                    "database",
                    "trace-command",
                    "--use-build-mode",
@ -378,7 +378,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                ...getExtraOptionsFromEnv(["database", "finalize"]),
                databasePath,
            ];
-            await runTool(cmd, args);
+            await runCli(cmd, args);
        },
        async resolveLanguages() {
            const codeqlArgs = [
@ -387,7 +387,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                "--format=json",
                ...getExtraOptionsFromEnv(["resolve", "languages"]),
            ];
-            const output = await runTool(cmd, codeqlArgs);
+            const output = await runCli(cmd, codeqlArgs);
            try {
                return JSON.parse(output);
            }
@ -404,7 +404,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                ...(await getLanguageAliasingArguments(this)),
                ...getExtraOptionsFromEnv(["resolve", "languages"]),
            ];
-            const output = await runTool(cmd, codeqlArgs);
+            const output = await runCli(cmd, codeqlArgs);
            try {
                return JSON.parse(output);
            }
@ -423,7 +423,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            if (extraSearchPath !== undefined) {
                codeqlArgs.push("--additional-packs", extraSearchPath);
            }
-            const output = await runTool(cmd, codeqlArgs);
+            const output = await runCli(cmd, codeqlArgs);
            try {
                return JSON.parse(output);
            }
@ -442,7 +442,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            if (workingDir !== undefined) {
                codeqlArgs.push("--working-dir", workingDir);
            }
-            const output = await runTool(cmd, codeqlArgs);
+            const output = await runCli(cmd, codeqlArgs);
            try {
                return JSON.parse(output);
            }
@ -466,7 +466,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            if (await util.codeQlVersionAtLeast(this, feature_flags_1.CODEQL_VERSION_FINE_GRAINED_PARALLELISM)) {
                codeqlArgs.push("--intra-layer-parallelism");
            }
-            await runTool(cmd, codeqlArgs);
+            await runCli(cmd, codeqlArgs);
        },
        async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, addSnippetsFlag, threadsFlag, verbosityFlag, automationDetailsId, config, features) {
            const shouldExportDiagnostics = await features.getValue(feature_flags_1.Feature.ExportDiagnosticsEnabled, this);
@ -512,7 +512,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            }
            // Capture the stdout, which contains the analysis summary. Don't stream it to the Actions
            // logs to avoid printing it twice.
-            return await runTool(cmd, codeqlArgs, {
+            return await runCli(cmd, codeqlArgs, {
                noStreamStdout: true,
            });
        },
@ -523,7 +523,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                ...getExtraOptionsFromEnv(["database", "print-baseline"]),
                databasePath,
            ];
-            return await runTool(cmd, codeqlArgs);
+            return await runCli(cmd, codeqlArgs);
        },
        /**
         * Download specified packs into the package cache. If the specified
@ -551,7 +551,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                ...getExtraOptionsFromEnv(["pack", "download"]),
                ...packs,
            ];
-            const output = await runTool(cmd, codeqlArgs);
+            const output = await runCli(cmd, codeqlArgs);
            try {
                const parsedOutput = JSON.parse(output);
                if (Array.isArray(parsedOutput.packs) &&
@ -580,7 +580,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                `${cacheCleanupFlag}=${cleanupLevel}`,
                ...getExtraOptionsFromEnv(["database", "cleanup"]),
            ];
-            await runTool(cmd, codeqlArgs);
+            await runCli(cmd, codeqlArgs);
        },
        async databaseBundle(databasePath, outputFilePath, databaseName) {
            const args = [
@ -662,7 +662,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
            if (mergeRunsFromEqualCategory) {
                args.push("--sarif-merge-runs-from-equal-category");
            }
-            await runTool(cmd, args);
+            await runCli(cmd, args);
        },
    };
    // To ensure that status reports include the CodeQL CLI version wherever
@ -742,48 +742,16 @@ function getExtraOptions(options, paths, pathInfo) {
        : getExtraOptions(options?.[paths[0]], paths?.slice(1), pathInfo.concat(paths[0]));
    return all.concat(specific);
 }
-/*
- * A constant defining the maximum number of characters we will keep from
- * the programs stderr for logging. This serves two purposes:
- * (1) It avoids an OOM if a program fails in a way that results it
- *     printing many log lines.
- * (2) It avoids us hitting the limit of how much data we can send in our
- *     status reports on GitHub.com.
- */
-const maxErrorSize = 20_000;
-async function runTool(cmd, args = [], opts = {}) {
-    let stdout = "";
-    let stderr = "";
-    process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
-    const exitCode = await new toolrunner.ToolRunner(cmd, args, {
-        ignoreReturnCode: true,
-        listeners: {
-            stdout: (data) => {
-                stdout += data.toString("utf8");
-                if (!opts.noStreamStdout) {
-                    process.stdout.write(data);
-                }
-            },
-            stderr: (data) => {
-                let readStartIndex = 0;
-                // If the error is too large, then we only take the last 20,000 characters
-                if (data.length - maxErrorSize > 0) {
-                    // Eg: if we have 20,000 the start index should be 2.
-                    readStartIndex = data.length - maxErrorSize + 1;
-                }
-                stderr += data.toString("utf8", readStartIndex);
-                // Mimic the standard behavior of the toolrunner by writing stderr to stdout
-                process.stdout.write(data);
-            },
-        },
-        silent: true,
-        ...(opts.stdin ? { input: Buffer.from(opts.stdin || "") } : {}),
-    }).exec();
-    if (exitCode !== 0) {
-        const e = new cli_errors_1.CommandInvocationError(cmd, args, exitCode, stderr, stdout);
-        throw (0, cli_errors_1.wrapCliConfigurationError)(e);
+async function runCli(cmd, args = [], opts = {}) {
+    try {
+        return await (0, actions_util_1.runTool)(cmd, args, opts);
+    }
+    catch (e) {
+        if (e instanceof actions_util_1.CommandInvocationError) {
+            throw (0, cli_errors_1.wrapCliConfigurationError)(new cli_errors_1.CliError(e));
+        }
+        throw e;
    }
-    return stdout;
 }
 /**
 * Generates a code scanning configuration that is to be used for a scan.
--- a/lib/codeql.js.map
+++ b/lib/codeql.js.map
--- a/lib/codeql.test.js
+++ b/lib/codeql.test.js
@ -591,7 +591,7 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
    // safeWhich throws because of the test CodeQL object.
    sinon.stub(safeWhich, "safeWhich").resolves("");
    await t.throwsAsync(async () => await codeqlObject.databaseRunQueries(stubConfig.dbLocation, []), {
-        instanceOf: cli_errors_1.CommandInvocationError,
+        instanceOf: cli_errors_1.CliError,
        message: `Encountered a fatal error while running "codeql-for-testing database run-queries  --expect-discarded-cache --min-disk-free=1024 -v --intra-layer-parallelism". Exit code was 1 and error was: Oops! A fatal internal error occurred. Details:
    com.semmle.util.exception.CatastrophicError: An error occurred while evaluating ControlFlowGraph::ControlFlow::Root.isRootOf/1#dispred#f610e6ed/2@86282cc8
    Severe disk cache trouble (corruption or out of space) at /home/runner/work/_temp/codeql_databases/go/db-go/default/cache/pages/28/33.pack: Failed to write item to disk. See the logs for more details.`,
--- a/lib/codeql.test.js.map
+++ b/lib/codeql.test.js.map
--- a/lib/debug-artifacts.js
+++ b/lib/debug-artifacts.js
@ -30,9 +30,11 @@ exports.sanitizeArtifactName = sanitizeArtifactName;
 exports.uploadCombinedSarifArtifacts = uploadCombinedSarifArtifacts;
 exports.tryUploadAllAvailableDebugArtifacts = tryUploadAllAvailableDebugArtifacts;
 exports.uploadDebugArtifacts = uploadDebugArtifacts;
+exports.getArtifactUploaderClient = getArtifactUploaderClient;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const artifact = __importStar(require("@actions/artifact"));
+const artifactLegacy = __importStar(require("@actions/artifact-legacy"));
 const core = __importStar(require("@actions/core"));
 const adm_zip_1 = __importDefault(require("adm-zip"));
 const del_1 = __importDefault(require("del"));
@ -40,6 +42,7 @@ const actions_util_1 = require("./actions-util");
 const analyze_1 = require("./analyze");
 const codeql_1 = require("./codeql");
 const environment_1 = require("./environment");
+const feature_flags_1 = require("./feature-flags");
 const logging_1 = require("./logging");
 const util_1 = require("./util");
 function sanitizeArtifactName(name) {
@ -49,7 +52,7 @@ function sanitizeArtifactName(name) {
 * Upload Actions SARIF artifacts for debugging when CODEQL_ACTION_DEBUG_COMBINED_SARIF
 * environment variable is set
 */
-async function uploadCombinedSarifArtifacts(logger) {
+async function uploadCombinedSarifArtifacts(logger, gitHubVariant, features) {
    const tempDir = (0, actions_util_1.getTemporaryDirectory)();
    // Upload Actions SARIF artifacts for debugging when environment variable is set
    if (process.env["CODEQL_ACTION_DEBUG_COMBINED_SARIF"] === "true") {
@ -68,7 +71,7 @@ async function uploadCombinedSarifArtifacts(logger) {
            }
        }
        try {
-            await uploadDebugArtifacts(toUpload, baseTempDir, "combined-sarif-artifacts");
+            await uploadDebugArtifacts(logger, toUpload, baseTempDir, "combined-sarif-artifacts", gitHubVariant, features);
        }
        catch (e) {
            logger.warning(`Failed to upload combined SARIF files as Actions debugging artifact. Reason: ${(0, util_1.getErrorMessage)(e)}`);
@ -128,7 +131,7 @@ async function tryBundleDatabase(config, language, logger) {
 *
 * Logs and suppresses any errors that occur.
 */
-async function tryUploadAllAvailableDebugArtifacts(config, logger) {
+async function tryUploadAllAvailableDebugArtifacts(config, logger, features) {
    const filesToUpload = [];
    try {
        for (const language of config.languages) {
@ -168,13 +171,13 @@ async function tryUploadAllAvailableDebugArtifacts(config, logger) {
        return;
    }
    try {
-        await (0, logging_1.withGroup)("Uploading debug artifacts", async () => uploadDebugArtifacts(filesToUpload, config.dbLocation, config.debugArtifactName));
+        await (0, logging_1.withGroup)("Uploading debug artifacts", async () => uploadDebugArtifacts(logger, filesToUpload, config.dbLocation, config.debugArtifactName, config.gitHubVersion.type, features));
    }
    catch (e) {
        logger.warning(`Failed to upload debug artifacts. Reason: ${(0, util_1.getErrorMessage)(e)}`);
    }
 }
-async function uploadDebugArtifacts(toUpload, rootDir, artifactName) {
+async function uploadDebugArtifacts(logger, toUpload, rootDir, artifactName, ghVariant, features) {
    if (toUpload.length === 0) {
        return;
    }
@ -189,11 +192,35 @@ async function uploadDebugArtifacts(toUpload, rootDir, artifactName) {
            core.info("Could not parse user-specified `matrix` input into JSON. The debug artifact will not be named with the user's `matrix` input.");
        }
    }
-    await artifact.create().uploadArtifact(sanitizeArtifactName(`${artifactName}${suffix}`), toUpload.map((file) => path.normalize(file)), path.normalize(rootDir), {
-        continueOnError: true,
-        // ensure we don't keep the debug artifacts around for too long since they can be large.
-        retentionDays: 7,
-    });
+    const artifactUploader = await getArtifactUploaderClient(logger, ghVariant, features);
+    try {
+        await artifactUploader.uploadArtifact(sanitizeArtifactName(`${artifactName}${suffix}`), toUpload.map((file) => path.normalize(file)), path.normalize(rootDir), {
+            // ensure we don't keep the debug artifacts around for too long since they can be large.
+            retentionDays: 7,
+        });
+    }
+    catch (e) {
+        // A failure to upload debug artifacts should not fail the entire action.
+        core.warning(`Failed to upload debug artifacts: ${e}`);
+    }
+}
+// `@actions/artifact@v2` is not yet supported on GHES so the legacy version of the client will be used on GHES
+// until it is supported. We also use the legacy version of the client if the feature flag is disabled.
+// The feature flag is named `ArtifactV4Upgrade` to reduce customer confusion; customers are primarily affected by
+// `actions/download-artifact`, whose upgrade to v4 must be accompanied by the `@actions/artifact@v2` upgrade.
+async function getArtifactUploaderClient(logger, ghVariant, features) {
+    if (ghVariant === util_1.GitHubVariant.GHES) {
+        logger.info("Debug artifacts can be consumed with `actions/download-artifact@v3` because the `v4` version is not yet compatible on GHES.");
+        return artifactLegacy.create();
+    }
+    else if (!(await features.getValue(feature_flags_1.Feature.ArtifactV4Upgrade))) {
+        logger.info("Debug artifacts can be consumed with `actions/download-artifact@v3`. To use the `actions/download-artifact@v4`, set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to true.");
+        return artifactLegacy.create();
+    }
+    else {
+        logger.info("Debug artifacts can be consumed with `actions/download-artifact@v4`.");
+        return new artifact.DefaultArtifactClient();
+    }
 }
 /**
 * If a database has not been finalized, we cannot run the `codeql database bundle`
--- a/lib/debug-artifacts.js.map
+++ b/lib/debug-artifacts.js.map
--- a/lib/debug-artifacts.test.js
+++ b/lib/debug-artifacts.test.js
@ -28,6 +28,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const ava_1 = __importDefault(require("ava"));
 const debugArtifacts = __importStar(require("./debug-artifacts"));
+const feature_flags_1 = require("./feature-flags");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util_1 = require("./util");
 (0, ava_1.default)("sanitizeArtifactName", (t) => {
    t.deepEqual(debugArtifacts.sanitizeArtifactName("hello-world_"), "hello-world_");
    t.deepEqual(debugArtifacts.sanitizeArtifactName("hello`world`"), "helloworld");
@ -36,6 +40,8 @@ const debugArtifacts = __importStar(require("./debug-artifacts"));
 });
 (0, ava_1.default)("uploadDebugArtifacts", async (t) => {
    // Test that no error is thrown if artifacts list is empty.
-    await t.notThrowsAsync(debugArtifacts.uploadDebugArtifacts([], "rootDir", "artifactName"));
+    const logger = (0, logging_1.getActionsLogger)();
+    const mockFeature = (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.ArtifactV4Upgrade]);
+    await t.notThrowsAsync(debugArtifacts.uploadDebugArtifacts(logger, [], "rootDir", "artifactName", util_1.GitHubVariant.DOTCOM, mockFeature));
 });
 //# sourceMappingURL=debug-artifacts.test.js.map
--- a/lib/debug-artifacts.test.js.map
+++ b/lib/debug-artifacts.test.js.map
@ -1 +1 @@
-{"version":3,"file":"debug-artifacts.test.js","sourceRoot":"","sources":["../src/debug-artifacts.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AAEvB,kEAAoD;AAEpD,IAAA,aAAI,EAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE;IACjC,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACnD,cAAc,CACf,CAAC;IACF,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACnD,YAAY,CACb,CAAC;IACF,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5E,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,EAC9D,aAAa,CACd,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,2DAA2D;IAC3D,MAAM,CAAC,CAAC,cAAc,CACpB,cAAc,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CACnE,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"debug-artifacts.test.js","sourceRoot":"","sources":["../src/debug-artifacts.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AAEvB,kEAAoD;AACpD,mDAA0C;AAC1C,uCAA6C;AAC7C,mDAAiD;AACjD,iCAAuC;AAEvC,IAAA,aAAI,EAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE;IACjC,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACnD,cAAc,CACf,CAAC;IACF,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACnD,YAAY,CACb,CAAC;IACF,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5E,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,EAC9D,aAAa,CACd,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,MAAM,WAAW,GAAG,IAAA,8BAAc,EAAC,CAAC,uBAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,CAAC,cAAc,CACpB,cAAc,CAAC,oBAAoB,CACjC,MAAM,EACN,EAAE,EACF,SAAS,EACT,cAAc,EACd,oBAAa,CAAC,MAAM,EACpB,WAAW,CACZ,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}
--- a/lib/feature-flags.js
+++ b/lib/feature-flags.js
@ -48,6 +48,7 @@ exports.CODEQL_VERSION_ZSTD_BUNDLE = "2.19.0";
 */
 var Feature;
 (function (Feature) {
+    Feature["ArtifactV4Upgrade"] = "artifact_v4_upgrade";
    Feature["CleanupTrapCaches"] = "cleanup_trap_caches";
    Feature["CppDependencyInstallation"] = "cpp_dependency_installation_enabled";
    Feature["DisableCsharpBuildless"] = "disable_csharp_buildless";
@ -58,6 +59,11 @@ var Feature;
    Feature["ZstdBundle"] = "zstd_bundle";
 })(Feature || (exports.Feature = Feature = {}));
 exports.featureConfig = {
+    [Feature.ArtifactV4Upgrade]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_ARTIFACT_V4_UPGRADE",
+        minimumVersion: undefined,
+    },
    [Feature.CleanupTrapCaches]: {
        defaultValue: false,
        envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES",
--- a/lib/feature-flags.js.map
+++ b/lib/feature-flags.js.map
--- a/lib/init-action-post-helper.js
+++ b/lib/init-action-post-helper.js
@ -132,7 +132,7 @@ async function run(uploadAllAvailableDebugArtifacts, printDebugLogs, config, rep
    // Upload appropriate Actions artifacts for debugging
    if (config.debugMode) {
        logger.info("Debug mode is on. Uploading available database bundles and logs as Actions debugging artifacts...");
-        await uploadAllAvailableDebugArtifacts(config, logger);
+        await uploadAllAvailableDebugArtifacts(config, logger, features);
        await printDebugLogs(config);
    }
    if (actionsUtil.isSelfHostedRunner()) {
--- a/lib/init-action-post-helper.js.map
+++ b/lib/init-action-post-helper.js.map
--- a/lib/resolve-environment-action.js
+++ b/lib/resolve-environment-action.js
@ -55,7 +55,7 @@ async function run() {
    }
    catch (unwrappedError) {
        const error = (0, util_1.wrapError)(unwrappedError);
-        if (error instanceof cli_errors_1.CommandInvocationError) {
+        if (error instanceof cli_errors_1.CliError) {
            // If the CLI failed to run successfully for whatever reason,
            // we just return an empty JSON object and proceed with the workflow.
            core.setOutput(ENVIRONMENT_OUTPUT_NAME, {});
--- a/lib/resolve-environment-action.js.map
+++ b/lib/resolve-environment-action.js.map
@ -1 +1 @@
-{"version":3,"file":"resolve-environment-action.js","sourceRoot":"","sources":["../src/resolve-environment-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAKwB;AACxB,6CAAgD;AAChD,6CAAsD;AACtD,iDAAmD;AACnD,uCAA6C;AAC7C,+DAAmE;AACnE,mDAKyB;AACzB,iCAOgB;AAEhB,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAElC,IAAI,MAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,kBAAkB,EAC7B,UAAU,EACV,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,CACP,CAAC;QACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAA,gCAAgB,EAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjD,IAAA,yBAAkB,EAAC,IAAA,+BAAgB,GAAE,EAAE,aAAa,CAAC,CAAC;QAEtD,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,gDAA0B,EAC7C,MAAM,CAAC,SAAS,EAChB,MAAM,EACN,gBAAgB,EAChB,IAAA,+BAAgB,EAAC,UAAU,CAAC,CAC7B,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,cAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QAExC,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;YAC5C,6DAA6D;YAC7D,qEAAqE;YACrE,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,CACZ,wFAAwF,KAAK,CAAC,OAAO,EAAE,CACxG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,kFAAkF;YAClF,IAAI,CAAC,SAAS,CACZ,wFAAwF,KAAK,CAAC,OAAO,EAAE,CACxG,CAAC;YAEF,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,kBAAkB,EAC7B,IAAA,gCAAgB,EAAC,KAAK,CAAC,EACvB,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,EACN,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CAAC;YACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAA,gCAAgB,EAAC,gBAAgB,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,kBAAkB,EAC7B,SAAS,EACT,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,CACP,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAA,gCAAgB,EAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,GAAG,0BAAU,CAAC,kBAAkB,mBAAmB,IAAA,sBAAe,EAChE,KAAK,CACN,EAAE,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAA,sBAAe,GAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"resolve-environment-action.js","sourceRoot":"","sources":["../src/resolve-environment-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAKwB;AACxB,6CAAgD;AAChD,6CAAwC;AACxC,iDAAmD;AACnD,uCAA6C;AAC7C,+DAAmE;AACnE,mDAKyB;AACzB,iCAOgB;AAEhB,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAElC,IAAI,MAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,kBAAkB,EAC7B,UAAU,EACV,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,CACP,CAAC;QACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAA,gCAAgB,EAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjD,IAAA,yBAAkB,EAAC,IAAA,+BAAgB,GAAE,EAAE,aAAa,CAAC,CAAC;QAEtD,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,gDAA0B,EAC7C,MAAM,CAAC,SAAS,EAChB,MAAM,EACN,gBAAgB,EAChB,IAAA,+BAAgB,EAAC,UAAU,CAAC,CAC7B,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,cAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QAExC,IAAI,KAAK,YAAY,qBAAQ,EAAE,CAAC;YAC9B,6DAA6D;YAC7D,qEAAqE;YACrE,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,CACZ,wFAAwF,KAAK,CAAC,OAAO,EAAE,CACxG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,kFAAkF;YAClF,IAAI,CAAC,SAAS,CACZ,wFAAwF,KAAK,CAAC,OAAO,EAAE,CACxG,CAAC;YAEF,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,kBAAkB,EAC7B,IAAA,gCAAgB,EAAC,KAAK,CAAC,EACvB,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,EACN,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CAAC;YACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAA,gCAAgB,EAAC,gBAAgB,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,kBAAkB,EAC7B,SAAS,EACT,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,CACP,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAA,gCAAgB,EAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,GAAG,0BAAU,CAAC,kBAAkB,mBAAmB,IAAA,sBAAe,EAChE,KAAK,CACN,EAAE,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAA,sBAAe,GAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
--- a/lib/setup-codeql.js
+++ b/lib/setup-codeql.js
@ -38,7 +38,6 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const perf_hooks_1 = require("perf_hooks");
 const toolcache = __importStar(require("@actions/tool-cache"));
-const del_1 = __importDefault(require("del"));
 const fast_deep_equal_1 = __importDefault(require("fast-deep-equal"));
 const semver = __importStar(require("semver"));
 const uuid_1 = require("uuid");
@ -373,7 +372,7 @@ async function tryGetFallbackToolcacheVersion(cliVersion, tagName, logger) {
 }
 // Exported using `export const` for testing purposes. Specifically, we want to
 // be able to stub this function and have other functions in this file use that stub.
-const downloadCodeQL = async function (codeqlURL, maybeBundleVersion, maybeCliVersion, apiDetails, tempDir, logger) {
+const downloadCodeQL = async function (codeqlURL, maybeBundleVersion, maybeCliVersion, apiDetails, tarVersion, tempDir, logger) {
    const parsedCodeQLURL = new URL(codeqlURL);
    const searchParams = new URLSearchParams(parsedCodeQLURL.search);
    const headers = {
@ -403,12 +402,18 @@ const downloadCodeQL = async function (codeqlURL, maybeBundleVersion, maybeCliVe
    const archivedBundlePath = await toolcache.downloadTool(codeqlURL, dest, authorization, finalHeaders);
    const downloadDurationMs = Math.round(perf_hooks_1.performance.now() - toolsDownloadStart);
    logger.debug(`Finished downloading CodeQL bundle to ${archivedBundlePath} (${downloadDurationMs} ms).`);
-    logger.debug("Extracting CodeQL bundle.");
-    const extractionStart = perf_hooks_1.performance.now();
-    const extractedBundlePath = await tar.extract(archivedBundlePath, compressionMethod);
-    const extractionDurationMs = Math.round(perf_hooks_1.performance.now() - extractionStart);
-    logger.debug(`Finished extracting CodeQL bundle to ${extractedBundlePath} (${extractionDurationMs} ms).`);
-    await cleanUpGlob(archivedBundlePath, "CodeQL bundle archive", logger);
+    let extractedBundlePath;
+    let extractionDurationMs;
+    try {
+        logger.debug("Extracting CodeQL bundle.");
+        const extractionStart = perf_hooks_1.performance.now();
+        extractedBundlePath = await tar.extract(archivedBundlePath, compressionMethod, tarVersion, logger);
+        extractionDurationMs = Math.round(perf_hooks_1.performance.now() - extractionStart);
+        logger.debug(`Finished extracting CodeQL bundle to ${extractedBundlePath} (${extractionDurationMs} ms).`);
+    }
+    finally {
+        await (0, util_1.cleanUpGlob)(archivedBundlePath, "CodeQL bundle archive", logger);
+    }
    const bundleVersion = maybeBundleVersion ?? tryGetBundleVersionFromUrl(codeqlURL, logger);
    if (bundleVersion === undefined) {
        logger.debug("Could not cache CodeQL tools because we could not determine the bundle version from the " +
@ -429,7 +434,7 @@ const downloadCodeQL = async function (codeqlURL, maybeBundleVersion, maybeCliVe
    const toolcachedBundlePath = await toolcache.cacheDir(extractedBundlePath, "CodeQL", toolcacheVersion);
    // Defensive check: we expect `cacheDir` to copy the bundle to a new location.
    if (toolcachedBundlePath !== extractedBundlePath) {
-        await cleanUpGlob(extractedBundlePath, "CodeQL bundle from temporary directory", logger);
+        await (0, util_1.cleanUpGlob)(extractedBundlePath, "CodeQL bundle from temporary directory", logger);
    }
    return {
        codeqlFolder: toolcachedBundlePath,
@ -492,6 +497,10 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau
        }
        catch (e) {
            zstdFailureReason = util.getErrorMessage(e) || "unknown error";
+            if (e instanceof actions_util_1.CommandInvocationError) {
+                zstdFailureReason += ` Full error: ${e.stderr}`;
+                logger.debug(`Invocation output the following to stderr: ${e.stderr}`);
+            }
            logger.warning(`Failed to set up CodeQL tools with zstd. Falling back to gzipped version. Error: ${util.getErrorMessage(e)}`);
        }
    }
@ -510,7 +519,7 @@ async function setupCodeQLBundleWithCompressionMethod(toolsInput, apiDetails, te
    switch (source.sourceType) {
        case "local": {
            const compressionMethod = tar.inferCompressionMethod(source.codeqlTarPath);
-            codeqlFolder = await tar.extract(source.codeqlTarPath, compressionMethod);
+            codeqlFolder = await tar.extract(source.codeqlTarPath, compressionMethod, zstdAvailability.version, logger);
            toolsSource = ToolsSource.Local;
            break;
        }
@ -520,7 +529,7 @@ async function setupCodeQLBundleWithCompressionMethod(toolsInput, apiDetails, te
            toolsSource = ToolsSource.Toolcache;
            break;
        case "download": {
-            const result = await (0, exports.downloadCodeQL)(source.codeqlURL, source.bundleVersion, source.cliVersion, apiDetails, tempDir, logger);
+            const result = await (0, exports.downloadCodeQL)(source.codeqlURL, source.bundleVersion, source.cliVersion, apiDetails, zstdAvailability.version, tempDir, logger);
            toolsVersion = result.toolsVersion;
            codeqlFolder = result.codeqlFolder;
            toolsDownloadStatusReport = result.statusReport;
@ -538,24 +547,6 @@ async function setupCodeQLBundleWithCompressionMethod(toolsInput, apiDetails, te
        zstdAvailability,
    };
 }
-async function cleanUpGlob(glob, name, logger) {
-    logger.debug(`Cleaning up ${name}.`);
-    try {
-        const deletedPaths = await (0, del_1.default)(glob, { force: true });
-        if (deletedPaths.length === 0) {
-            logger.warning(`Failed to clean up ${name}: no files found matching ${glob}.`);
-        }
-        else if (deletedPaths.length === 1) {
-            logger.debug(`Cleaned up ${name}.`);
-        }
-        else {
-            logger.debug(`Cleaned up ${name} (${deletedPaths.length} files).`);
-        }
-    }
-    catch (e) {
-        logger.warning(`Failed to clean up ${name}: ${e}.`);
-    }
-}
 function sanitizeUrlForStatusReport(url) {
    return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some((repo) => url.startsWith(`https://github.com/${repo}/releases/download/`))
        ? url
--- a/lib/setup-codeql.js.map
+++ b/lib/setup-codeql.js.map
--- a/lib/start-proxy-action-post.js
+++ b/lib/start-proxy-action-post.js
@ -28,10 +28,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 * It will run after the all steps in this job, in reverse order in relation to
 * other `post:` hooks.
 */
-const artifact = __importStar(require("@actions/artifact"));
 const core = __importStar(require("@actions/core"));
 const actionsUtil = __importStar(require("./actions-util"));
+const api_client_1 = require("./api-client");
 const configUtils = __importStar(require("./config-utils"));
+const debug_artifacts_1 = require("./debug-artifacts");
+const feature_flags_1 = require("./feature-flags");
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
 const util_1 = require("./util");
 async function runWrapper() {
    try {
@ -47,11 +51,19 @@ async function runWrapper() {
    if ((config && config.debugMode) || core.isDebug()) {
        const logFilePath = core.getState("proxy-log-file");
        core.info("Debug mode is on. Uploading proxy log as Actions debugging artifact...");
+        if (config?.gitHubVersion.type === undefined) {
+            core.warning(`Did not upload debug artifacts because cannot determine the GitHub variant running.`);
+            return;
+        }
+        const logger = (0, logging_1.getActionsLogger)();
+        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
+        const repositoryNwo = (0, repository_1.parseRepositoryNwo)((0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY"));
+        const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, actionsUtil.getTemporaryDirectory(), logger);
        try {
-            await artifact
-                .create()
-                .uploadArtifact("proxy-log-file", [logFilePath], actionsUtil.getTemporaryDirectory(), {
-                continueOnError: true,
+            const artifactUploader = await (0, debug_artifacts_1.getArtifactUploaderClient)(logger, gitHubVersion.type, features);
+            await artifactUploader.uploadArtifact("proxy-log-file", [logFilePath], actionsUtil.getTemporaryDirectory(), {
+                // ensure we don't keep the debug artifacts around for too long since they can be large.
                retentionDays: 7,
            });
        }
--- a/lib/start-proxy-action-post.js.map
+++ b/lib/start-proxy-action-post.js.map
@ -1 +1 @@
-{"version":3,"file":"start-proxy-action-post.js","sourceRoot":"","sources":["../src/start-proxy-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,4DAA8C;AAC9C,oDAAsC;AAEtC,4DAA8C;AAC9C,4DAA8C;AAC9C,iCAAyC;AAEzC,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC/C,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,wCAAwC,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CACxC,WAAW,CAAC,qBAAqB,EAAE,EACnC,IAAI,CACL,CAAC;IAEF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,wEAAwE,CACzE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ;iBACX,MAAM,EAAE;iBACR,cAAc,CACb,gBAAgB,EAChB,CAAC,WAAW,CAAC,EACb,WAAW,CAAC,qBAAqB,EAAE,EACnC;gBACE,eAAe,EAAE,IAAI;gBACrB,aAAa,EAAE,CAAC;aACjB,CACF,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yEAAyE;YACzE,IAAI,CAAC,OAAO,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"start-proxy-action-post.js","sourceRoot":"","sources":["../src/start-proxy-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,oDAAsC;AAEtC,4DAA8C;AAC9C,6CAAgD;AAChD,4DAA8C;AAC9C,uDAA8D;AAC9D,mDAA2C;AAC3C,uCAA6C;AAC7C,6CAAkD;AAClD,iCAIgB;AAEhB,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC/C,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,wCAAwC,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CACxC,WAAW,CAAC,qBAAqB,EAAE,EACnC,IAAI,CACL,CAAC;IAEF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,wEAAwE,CACzE,CAAC;QACF,IAAI,MAAM,EAAE,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,CACV,qFAAqF,CACtF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAA,+BAAkB,EACtC,IAAA,0BAAmB,EAAC,mBAAmB,CAAC,CACzC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,aAAa,EACb,WAAW,CAAC,qBAAqB,EAAE,EACnC,MAAM,CACP,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,IAAA,2CAAyB,EACtD,MAAM,EACN,aAAa,CAAC,IAAI,EAClB,QAAQ,CACT,CAAC;YAEF,MAAM,gBAAgB,CAAC,cAAc,CACnC,gBAAgB,EAChB,CAAC,WAAW,CAAC,EACb,WAAW,CAAC,qBAAqB,EAAE,EACnC;gBACE,wFAAwF;gBACxF,aAAa,EAAE,CAAC;aACjB,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yEAAyE;YACzE,IAAI,CAAC,OAAO,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
--- a/lib/tar.js
+++ b/lib/tar.js
@ -22,13 +22,21 @@ var __importStar = (this && this.__importStar) || function (mod) {
    __setModuleDefault(result, mod);
    return result;
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isZstdAvailable = isZstdAvailable;
 exports.extract = extract;
+exports.extractTarZst = extractTarZst;
 exports.inferCompressionMethod = inferCompressionMethod;
+const fs = __importStar(require("fs"));
+const path_1 = __importDefault(require("path"));
 const toolrunner_1 = require("@actions/exec/lib/toolrunner");
 const toolcache = __importStar(require("@actions/tool-cache"));
 const safe_which_1 = require("@chrisgavin/safe-which");
+const uuid_1 = require("uuid");
+const actions_util_1 = require("./actions-util");
 const util_1 = require("./util");
 const MIN_REQUIRED_BSD_TAR_VERSION = "3.4.3";
 const MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
@ -90,21 +98,65 @@ async function isZstdAvailable(logger) {
        return { available: false };
    }
 }
-async function extract(path, compressionMethod) {
+async function extract(tarPath, compressionMethod, tarVersion, logger) {
    switch (compressionMethod) {
        case "gzip":
-            // While we could also ask tar to autodetect the compression method,
-            // we defensively keep the gzip call identical as requesting a gzipped
-            // bundle will soon be a fallback option.
-            return await toolcache.extractTar(path);
+            // Defensively continue to call the toolcache API as requesting a gzipped
+            // bundle may be a fallback option.
+            return await toolcache.extractTar(tarPath);
        case "zstd":
-            // By specifying only the "x" flag, we ask tar to autodetect the
-            // compression method.
-            return await toolcache.extractTar(path, undefined, "x");
+            if (!tarVersion) {
+                throw new Error("Could not determine tar version, which is required to extract a Zstandard archive.");
+            }
+            return await extractTarZst(tarPath, tarVersion, logger);
    }
 }
-function inferCompressionMethod(path) {
-    if (path.endsWith(".tar.gz")) {
+/**
+ * Extract a compressed tar archive
+ *
+ * @param file     path to the tar
+ * @param dest     destination directory. Optional.
+ * @returns        path to the destination directory
+ */
+async function extractTarZst(file, tarVersion, logger) {
+    if (!file) {
+        throw new Error("parameter 'file' is required");
+    }
+    // Create dest
+    const dest = await createExtractFolder();
+    try {
+        // Initialize args
+        const args = ["-x", "-v"];
+        let destArg = dest;
+        let fileArg = file;
+        if (process.platform === "win32" && tarVersion.type === "gnu") {
+            args.push("--force-local");
+            destArg = dest.replace(/\\/g, "/");
+            // Technically only the dest needs to have `/` but for aesthetic consistency
+            // convert slashes in the file arg too.
+            fileArg = file.replace(/\\/g, "/");
+        }
+        if (tarVersion.type === "gnu") {
+            // Suppress warnings when using GNU tar to extract archives created by BSD tar
+            args.push("--warning=no-unknown-keyword");
+            args.push("--overwrite");
+        }
+        args.push("-C", destArg, "-f", fileArg);
+        await (0, actions_util_1.runTool)(`tar`, args);
+    }
+    catch (e) {
+        await (0, util_1.cleanUpGlob)(dest, "extraction destination directory", logger);
+        throw e;
+    }
+    return dest;
+}
+async function createExtractFolder() {
+    const dest = path_1.default.join((0, actions_util_1.getTemporaryDirectory)(), (0, uuid_1.v4)());
+    fs.mkdirSync(dest, { recursive: true });
+    return dest;
+}
+function inferCompressionMethod(tarPath) {
+    if (tarPath.endsWith(".tar.gz")) {
        return "gzip";
    }
    return "zstd";
--- a/lib/tar.js.map
+++ b/lib/tar.js.map
@ -1 +1 @@
-{"version":3,"file":"tar.js","sourceRoot":"","sources":["../src/tar.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,0CA4BC;AAID,0BAeC;AAED,wDAKC;AA3GD,6DAA0D;AAC1D,+DAAiD;AACjD,uDAAmD;AAGnD,iCAAqC;AAErC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAC7C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAO5C,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,MAAM,IAAA,sBAAS,EAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,uBAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE;QACxD,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;SACF;KACF,CAAC,CAAC,IAAI,EAAE,CAAC;IACV,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,oEAAoE;IACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAOM,KAAK,UAAU,eAAe,CACnC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,gBAAgB,OAAO,GAAG,CAAC,CAAC;QACrD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK;gBACR,OAAO;oBACL,SAAS,EAAE,OAAO,IAAI,4BAA4B;oBAClD,OAAO,EAAE,UAAU;iBACpB,CAAC;YACJ,KAAK,KAAK;gBACR,OAAO;oBACL,SAAS,EAAE,OAAO,IAAI,4BAA4B;oBAClD,OAAO,EAAE,UAAU;iBACpB,CAAC;YACJ;gBACE,IAAA,kBAAW,EAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CACV,oFAAoF;YAClF,6BAA6B,CAAC,EAAE,CACnC,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAIM,KAAK,UAAU,OAAO,CAC3B,IAAY,EACZ,iBAAoC;IAEpC,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,MAAM;YACT,oEAAoE;YACpE,sEAAsE;YACtE,yCAAyC;YACzC,OAAO,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM;YACT,gEAAgE;YAChE,sBAAsB;YACtB,OAAO,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,IAAY;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../src/tar.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,0CA4BC;AAID,0BAmBC;AASD,sCAyCC;AAQD,wDAKC;AA5KD,uCAAyB;AACzB,gDAAwB;AAExB,6DAA0D;AAC1D,+DAAiD;AACjD,uDAAmD;AACnD,+BAAoC;AAEpC,iDAAgE;AAEhE,iCAAkD;AAElD,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAC7C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAO5C,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,MAAM,IAAA,sBAAS,EAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,uBAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE;QACxD,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;SACF;KACF,CAAC,CAAC,IAAI,EAAE,CAAC;IACV,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,oEAAoE;IACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAOM,KAAK,UAAU,eAAe,CACnC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,gBAAgB,OAAO,GAAG,CAAC,CAAC;QACrD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK;gBACR,OAAO;oBACL,SAAS,EAAE,OAAO,IAAI,4BAA4B;oBAClD,OAAO,EAAE,UAAU;iBACpB,CAAC;YACJ,KAAK,KAAK;gBACR,OAAO;oBACL,SAAS,EAAE,OAAO,IAAI,4BAA4B;oBAClD,OAAO,EAAE,UAAU;iBACpB,CAAC;YACJ;gBACE,IAAA,kBAAW,EAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CACV,oFAAoF;YAClF,6BAA6B,CAAC,EAAE,CACnC,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAIM,KAAK,UAAU,OAAO,CAC3B,OAAe,EACf,iBAAoC,EACpC,UAAkC,EAClC,MAAc;IAEd,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,MAAM;YACT,yEAAyE;YACzE,mCAAmC;YACnC,OAAO,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,MAAM;YACT,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,UAAsB,EACtB,MAAc;IAEd,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,cAAc;IACd,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAEzC,IAAI,CAAC;QACH,kBAAkB;QAClB,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAEnC,4EAA4E;YAC5E,uCAAuC;YACvC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,8EAA8E;YAC9E,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAA,sBAAO,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAA,kBAAW,EAAC,IAAI,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC;IACV,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,IAAA,oCAAqB,GAAE,EAAE,IAAA,SAAM,GAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAAe;IACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
--- a/lib/upload-sarif-action-post.js
+++ b/lib/upload-sarif-action-post.js
@ -29,17 +29,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 * other `post:` hooks.
 */
 const core = __importStar(require("@actions/core"));
+const actions_util_1 = require("./actions-util");
+const api_client_1 = require("./api-client");
 const debugArtifacts = __importStar(require("./debug-artifacts"));
 const environment_1 = require("./environment");
+const feature_flags_1 = require("./feature-flags");
 const logging_1 = require("./logging");
+const repository_1 = require("./repository");
 const util_1 = require("./util");
 async function runWrapper() {
    try {
        const logger = (0, logging_1.getActionsLogger)();
+        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
+        const repositoryNwo = (0, repository_1.parseRepositoryNwo)((0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY"));
+        const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), logger);
        // Upload SARIF artifacts if we determine that this is a third-party analysis run.
        // For first-party runs, this artifact will be uploaded in the `analyze-post` step.
        if (process.env[environment_1.EnvVar.INIT_ACTION_HAS_RUN] !== "true") {
-            await (0, logging_1.withGroup)("Uploading combined SARIF debug artifact", () => debugArtifacts.uploadCombinedSarifArtifacts(logger));
+            if (gitHubVersion.type === undefined) {
+                core.warning(`Did not upload debug artifacts because cannot determine the GitHub variant running.`);
+                return;
+            }
+            await (0, logging_1.withGroup)("Uploading combined SARIF debug artifact", () => debugArtifacts.uploadCombinedSarifArtifacts(logger, gitHubVersion.type, features));
        }
    }
    catch (error) {
--- a/lib/upload-sarif-action-post.js.map
+++ b/lib/upload-sarif-action-post.js.map
@ -1 +1 @@
-{"version":3,"file":"upload-sarif-action-post.js","sourceRoot":"","sources":["../src/upload-sarif-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,oDAAsC;AAEtC,kEAAoD;AACpD,+CAAuC;AACvC,uCAAwD;AACxD,iCAAyC;AAEzC,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;QAClC,kFAAkF;QAClF,mFAAmF;QACnF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,mBAAmB,CAAC,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,IAAA,mBAAS,EAAC,yCAAyC,EAAE,GAAG,EAAE,CAC9D,cAAc,CAAC,4BAA4B,CAAC,MAAM,CAAC,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,yCAAyC,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"upload-sarif-action-post.js","sourceRoot":"","sources":["../src/upload-sarif-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,oDAAsC;AAEtC,iDAAuD;AACvD,6CAAgD;AAChD,kEAAoD;AACpD,+CAAuC;AACvC,mDAA2C;AAC3C,uCAAwD;AACxD,6CAAkD;AAClD,iCAIgB;AAEhB,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAA,+BAAkB,EACtC,IAAA,0BAAmB,EAAC,mBAAmB,CAAC,CACzC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,aAAa,EACb,IAAA,oCAAqB,GAAE,EACvB,MAAM,CACP,CAAC;QAEF,kFAAkF;QAClF,mFAAmF;QACnF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,mBAAmB,CAAC,KAAK,MAAM,EAAE,CAAC;YACvD,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,CAAC,OAAO,CACV,qFAAqF,CACtF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,IAAA,mBAAS,EAAC,yCAAyC,EAAE,GAAG,EAAE,CAC9D,cAAc,CAAC,4BAA4B,CACzC,MAAM,EACN,aAAa,CAAC,IAAI,EAClB,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,yCAAyC,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
--- a/lib/util.js
+++ b/lib/util.js
@ -68,6 +68,7 @@ exports.checkDiskUsage = checkDiskUsage;
 exports.checkActionVersion = checkActionVersion;
 exports.cloneObject = cloneObject;
 exports.checkSipEnablement = checkSipEnablement;
+exports.cleanUpGlob = cleanUpGlob;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@ -902,4 +903,22 @@ async function checkSipEnablement(logger) {
        return undefined;
    }
 }
+async function cleanUpGlob(glob, name, logger) {
+    logger.debug(`Cleaning up ${name}.`);
+    try {
+        const deletedPaths = await (0, del_1.default)(glob, { force: true });
+        if (deletedPaths.length === 0) {
+            logger.warning(`Failed to clean up ${name}: no files found matching ${glob}.`);
+        }
+        else if (deletedPaths.length === 1) {
+            logger.debug(`Cleaned up ${name}.`);
+        }
+        else {
+            logger.debug(`Cleaned up ${name} (${deletedPaths.length} files).`);
+        }
+    }
+    catch (e) {
+        logger.warning(`Failed to clean up ${name}: ${e}.`);
+    }
+}
 //# sourceMappingURL=util.js.map
--- a/lib/util.js.map
+++ b/lib/util.js.map
--- a/node_modules/.bin/crc32
+++ b/node_modules/.bin/crc32
@ -0,0 +1 @@
+../crc-32/bin/crc32.njs
--- a/node_modules/.bin/dot-object
+++ b/node_modules/.bin/dot-object
@ -0,0 +1 @@
+../dot-object/bin/dot-object
--- a/node_modules/.bin/fxparser
+++ b/node_modules/.bin/fxparser
@ -0,0 +1 @@
+../fast-xml-parser/src/cli/cli.js
--- a/node_modules/.bin/glob
+++ b/node_modules/.bin/glob
@ -0,0 +1 @@
+../glob/dist/esm/bin.mjs
--- a/node_modules/.bin/mkdirp
+++ b/node_modules/.bin/mkdirp
@ -0,0 +1 @@
+../mkdirp/bin/cmd.js
--- a/node_modules/.bin/protoc
+++ b/node_modules/.bin/protoc
@ -0,0 +1 @@
+../@protobuf-ts/protoc/protoc.js
--- a/node_modules/.bin/protoc-gen-dump
+++ b/node_modules/.bin/protoc-gen-dump
@ -0,0 +1 @@
+../@protobuf-ts/plugin/bin/protoc-gen-dump
--- a/node_modules/.bin/protoc-gen-ts
+++ b/node_modules/.bin/protoc-gen-ts
@ -0,0 +1 @@
+../@protobuf-ts/plugin/bin/protoc-gen-ts
--- a/node_modules/.bin/protoc-gen-twirp_ts
+++ b/node_modules/.bin/protoc-gen-twirp_ts
@ -0,0 +1 @@
+../twirp-ts/protoc-gen-twirp_ts
--- a/node_modules/.package-lock.json
+++ b/node_modules/.package-lock.json
--- a/node_modules/@actions/artifact-legacy/LICENSE.md
+++ b/node_modules/@actions/artifact-legacy/LICENSE.md
@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright 2019 GitHub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
--- a/node_modules/@actions/artifact-legacy/README.md
+++ b/node_modules/@actions/artifact-legacy/README.md
@ -0,0 +1,213 @@
+# `@actions/artifact`
+
+## Usage
+
+You can use this package to interact with the actions artifacts.
+- [Upload an Artifact](#Upload-an-Artifact)
+- [Download a Single Artifact](#Download-a-Single-Artifact)
+- [Download All Artifacts](#Download-all-Artifacts)
+- [Additional Documentation](#Additional-Documentation)
+- [Contributions](#Contributions)
+
+Relative paths and absolute paths are both allowed. Relative paths are rooted against the current working directory.
+
+## Upload an Artifact
+
+Method Name: `uploadArtifact`
+
+#### Inputs
+ - `name`
+    - The name of the artifact that is being uploaded
+    - Required
+ - `files`
+    - A list of file paths that describe what should be uploaded as part of the artifact
+    - If a path is provided that does not exist, an error will be thrown
+    - Can be absolute or relative. Internally everything is normalized and resolved
+    - Required
+ - `rootDirectory`
+    - A file path that denotes the root directory of the files being uploaded. This path is used to strip the paths provided in `files` to control how they are uploaded and structured
+    - If a file specified in `files` is not in the `rootDirectory`, an error will be thrown
+    - Required
+ - `options`
+    - Extra options that allow for the customization of the upload behavior
+    - Optional
+
+#### Available Options
+
+ - `continueOnError`
+    - Indicates if the artifact upload should continue in the event a file fails to upload. If there is a error during upload, a partial artifact will always be created and available for download at the end. The `size` reported will be the amount of storage that the user or org will be charged for the partial artifact.
+    - If set to `false`, and an error is encountered, all other uploads will stop and any files that were queued will not be attempted to be uploaded. The partial artifact available will only include files up until the failure.
+    - If set to `true` and an error is encountered, the failed file will be skipped and ignored and all other queued files will be attempted to be uploaded. There will be an artifact available for download at the end with everything excluding the file that failed to upload
+    - Optional, defaults to `true` if not specified
+- `retentionDays`
+    - Duration after which artifact will expire in days
+    - Minimum value: 1
+    - Maximum value: 90 unless changed by repository setting
+    - If this is set to a greater value than the retention settings allowed, the retention on artifacts will be reduced to match the max value allowed on the server, and the upload process will continue. An input of 0 assumes default retention value.
+
+#### Example using Absolute File Paths
+
+```js
+const artifact = require('@actions/artifact');
+const artifactClient = artifact.create()
+const artifactName = 'my-artifact';
+const files = [
+    '/home/user/files/plz-upload/file1.txt',
+    '/home/user/files/plz-upload/file2.txt',
+    '/home/user/files/plz-upload/dir/file3.txt'
+]
+const rootDirectory = '/home/user/files/plz-upload'
+const options = {
+    continueOnError: true
+}
+
+const uploadResult = await artifactClient.uploadArtifact(artifactName, files, rootDirectory, options)
+```
+
+#### Example using Relative File Paths
+```js
+// Assuming the current working directory is /home/user/files/plz-upload
+const artifact = require('@actions/artifact');
+const artifactClient = artifact.create()
+const artifactName = 'my-artifact';
+const files = [
+    'file1.txt',
+    'file2.txt',
+    'dir/file3.txt'
+]
+
+const rootDirectory = '.' // Also possible to use __dirname
+const options = {
+    continueOnError: false
+}
+
+const uploadResponse = await artifactClient.uploadArtifact(artifactName, files, rootDirectory, options)
+```
+
+#### Upload Result
+
+The returned `UploadResponse` will contain the following information
+
+- `artifactName`
+    - The name of the artifact that was uploaded
+- `artifactItems`
+    - A list of all files that describe what is uploaded if there are no errors encountered. Usually this will be equal to the inputted `files` with the exception of empty directories (will not be uploaded)
+- `size`
+    - Total size of the artifact that was uploaded in bytes
+- `failedItems`
+    - A list of items that were not uploaded successfully (this will include queued items that were not uploaded if `continueOnError` is set to false). This is a subset of `artifactItems`
+
+## Download a Single Artifact
+
+Method Name: `downloadArtifact`
+
+#### Inputs
+ - `name`
+    - The name of the artifact to download
+    - Required
+ - `path`
+    - Path that denotes where the artifact will be downloaded to
+    - Optional. Defaults to the GitHub workspace directory(`$GITHUB_WORKSPACE`) if not specified
+ - `options`
+    - Extra options that allow for the customization of the download behavior
+    - Optional
+
+
+#### Available Options
+
+ - `createArtifactFolder`
+    - Specifies if a folder (the artifact name) is created for the artifact that is downloaded (contents downloaded into this folder),
+    - Optional. Defaults to false if not specified
+
+#### Example
+
+```js
+const artifact = require('@actions/artifact');
+const artifactClient = artifact.create()
+const artifactName = 'my-artifact';
+const path = 'some/directory'
+const options = {
+    createArtifactFolder: false
+}
+
+const downloadResponse = await artifactClient.downloadArtifact(artifactName, path, options)
+
+// Post download, the directory structure will look like this
+/some
+    /directory
+        /file1.txt
+        /file2.txt
+        /dir
+            /file3.txt
+
+// If createArtifactFolder is set to true, the directory structure will look like this
+/some
+    /directory
+        /my-artifact
+            /file1.txt
+            /file2.txt
+            /dir
+                /file3.txt
+```
+
+#### Download Response
+
+The returned `DownloadResponse` will contain the following information
+
+  - `artifactName`
+    - The name of the artifact that was downloaded
+  - `downloadPath`
+    - The full Path to where the artifact was downloaded
+
+
+## Download All Artifacts
+
+Method Name: `downloadAllArtifacts`
+
+#### Inputs
+ - `path`
+    - Path that denotes where the artifact will be downloaded to
+    - Optional. Defaults to the GitHub workspace directory(`$GITHUB_WORKSPACE`) if not specified
+
+```js
+const artifact = require('@actions/artifact');
+const artifactClient = artifact.create();
+const downloadResponse = await artifactClient.downloadAllArtifacts();
+
+// output result
+for (response in downloadResponse) {
+    console.log(response.artifactName);
+    console.log(response.downloadPath);
+}
+```
+
+Because there are multiple artifacts, an extra directory (denoted by the name of the artifact) will be created for each artifact in the path. With 2 artifacts(`my-artifact-1` and `my-artifact-2` for example) and the default path, the directory structure will be as follows:
+```js
+/GITHUB_WORKSPACE
+    /my-artifact-1
+        / .. contents of `my-artifact-1`
+    /my-artifact-2
+        / .. contents of `my-artifact-2`
+```
+
+#### Download Result
+
+An array will be returned that describes the results for downloading all artifacts. The number of items in the array indicates the number of artifacts that were downloaded.
+
+Each artifact will have the same `DownloadResponse` as if it was individually downloaded
+  - `artifactName`
+    - The name of the artifact that was downloaded
+  - `downloadPath`
+    - The full Path to where the artifact was downloaded
+
+## Additional Documentation
+
+Check out [additional-information](docs/additional-information.md) for extra documentation around usage, restrictions and behavior.
+
+Check out [implementation-details](docs/implementation-details.md) for extra information about the implementation of this package.
+
+## Contributions
+
+See [contributor guidelines](https://github.com/actions/toolkit/blob/main/.github/CONTRIBUTING.md) for general guidelines and information about toolkit contributions.
+
+For contributions related to this package, see [artifact contributions](CONTRIBUTIONS.md) for more information.
--- a/node_modules/@actions/artifact-legacy/lib/artifact-client.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/artifact-client.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/artifact-client.js
+++ b/node_modules/@actions/artifact-legacy/lib/artifact-client.js
--- a/node_modules/@actions/artifact-legacy/lib/artifact-client.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/artifact-client.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/artifact-client.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/artifact-client.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/artifact-client.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/artifact-client.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/artifact-client.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/artifact-client.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/config-variables.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/config-variables.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/config-variables.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/config-variables.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/config-variables.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/config-variables.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/contracts.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/contracts.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/contracts.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/contracts.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/contracts.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/contracts.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/crc64.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/crc64.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/crc64.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/crc64.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/crc64.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/crc64.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-http-client.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-http-client.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-http-client.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-http-client.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-http-client.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-http-client.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-options.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-options.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-options.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-options.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-options.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-options.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-response.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-response.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-response.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-response.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-response.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-response.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-specification.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-specification.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-specification.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-specification.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/download-specification.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/download-specification.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/http-manager.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/http-manager.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/http-manager.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/http-manager.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/http-manager.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/http-manager.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/path-and-artifact-name-validation.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/path-and-artifact-name-validation.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/path-and-artifact-name-validation.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/path-and-artifact-name-validation.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/path-and-artifact-name-validation.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/path-and-artifact-name-validation.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/requestUtils.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/requestUtils.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/requestUtils.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/requestUtils.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/requestUtils.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/requestUtils.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/status-reporter.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/status-reporter.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/status-reporter.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/status-reporter.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/status-reporter.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/status-reporter.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-gzip.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-gzip.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-gzip.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-gzip.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-gzip.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-gzip.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-http-client.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-http-client.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-http-client.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-http-client.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-http-client.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-http-client.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-options.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-options.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-options.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-options.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-options.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-options.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-response.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-response.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-response.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-response.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-response.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-response.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-specification.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-specification.d.ts
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-specification.js
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-specification.js
--- a/node_modules/@actions/artifact-legacy/lib/internal/upload-specification.js.map
+++ b/node_modules/@actions/artifact-legacy/lib/internal/upload-specification.js.map
--- a/node_modules/@actions/artifact-legacy/lib/internal/utils.d.ts
+++ b/node_modules/@actions/artifact-legacy/lib/internal/utils.d.ts
--- a/Show more
+++ b/Show more